QuestionQ104

Attacks and Exploits

A penetration tester obtains low-privilege shell access to a host and finds a world-writable script that runs regularly as root. The tester executes:

openssl passwd password  
$l$OjxLvZ85$Fdr51vn/Z4zXWsQR/Xrj .  

The tester then adds this line to the world-writable script:

echo 'root2:$l$OjxLvZ85$Fdr51vn/Z4zXWsQR/Xrj1001:1001:,,,: /root:/bin/bash" >> /etc/passwd  

Which action should the penetration tester take for this exploit to work correctly?

  • A Use only a single redirect to /etc/password.
  • B Generate the password using md5sum.
  • C Log in to the host using SSH
  • D Change the 1001 entries to 0.
Explanation

An account entry with UID 0 is treated as the root user. Changing the UID and GID fields from 1001 to 0 makes the added root2 account a root-privileged account when it is authenticated.

Community Discussion

No comments yet. Be the first to start the discussion!